> For the complete documentation index, see [llms.txt](https://api.veratad.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://api.veratad.com/identity-verification/idmatch-us/coppa-compliance.md).

# COPPA Compliance

## Overview

The **COPPA Compliance** service verifies that a target is a real, identifiable **adult** so you can obtain **Verifiable Parental Consent (VPC)** under the Children's Online Privacy Protection Act (COPPA). Before a child can use your service, COPPA requires you to confirm that the person providing consent is the parent or guardian — an adult — and this service performs that adult identity verification against trusted and verified data sources.

Under the **FTC Safe Harbor Guidelines**, a transaction passes only when we can:

* **Locate** the target in trusted and verified data sources
* Confirm the target is **not deceased**
* Confirm the target is **18 or older**
* Confirm the target has provided an **accurate SSN variable**

You send the target's identity attributes in a single **HTTPS POST** request and receive a synchronous response in **2–3 seconds** containing a `result` object with `action`, `detail`, and `issues` fields.

## SSN variable

Every request must include the target's SSN in **one** of three formats:

| Format         | Description                                                                                                                                                           |
| -------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Full 9 SSN** | The complete nine-digit SSN.                                                                                                                                          |
| **Last 4 SSN** | The last four digits of the SSN.                                                                                                                                      |
| **IDR Calc**   | Veratad's patented process — the user sums at least two digits of their SSN to prove they know it, without collecting sensitive PII. See [IDR Calc](#idr-calc) below. |

## Service variants

This service is available in two variants. Both share the same **endpoint, response objects, rulesets, and testing process**; they differ only in the identity attributes you must send.

| Variant                        | Locates the target using                                       |
| ------------------------------ | -------------------------------------------------------------- |
| **IDMatchCOPPA5.0**            | Name + address + SSN variable (the base service)               |
| **IDMatchCOPPA5.0.NO.ADDRESS** | Name + SSN variable + either Date of Birth **or** phone number |

{% hint style="info" %}
**PRO TIP:** The more data you send, the higher your success rate. The required inputs are the minimum needed to run a transaction, but sending everything you collect helps us locate the adult in the data sources and return a `PASS`. Add optional attributes beyond the minimum — for example, include the target's `dob` with the base **IDMatchCOPPA5.0** service, or both `phone` and `dob` with the **IDMatchCOPPA5.0.NO.ADDRESS** variant — to maximize your match rate.
{% endhint %}

***

## Endpoint

Both variants are served from the same endpoint:

**POST** `https://production.idresponse.com/process/5/gateway`

The service name you send in the request body (`service`) determines which variant runs.

***

## IDMatchCOPPA5.0 (base service)

Locates the target by **name and address**, then validates the SSN variable.

### Request

{% tabs %}
{% tab title="cURL" %}

```bash
curl -X POST https://production.idresponse.com/process/5/gateway \
-H "Content-Type: application/json" \
-d '{
  "user": "USERNAME",
  "pass": "PASSWORD",
  "service": "IDMatchCOPPA5.0",
  "reference": "12345 {A UNIQUE ID}",
  "target": {
    "fn": "Barbara",
    "ln": "Miller",
    "addr": "123 Main St",
    "city": "Stratford",
    "state": "CT",
    "zip": "06614",
    "dob": "19740821",
    "ssn": "5698",
    "age": "18+",
    "test_key": "general_identity"
  }
}'
```

{% endtab %}

{% tab title="JSON" %}

```json
{
  "user": "USERNAME",
  "pass": "PASSWORD",
  "service": "IDMatchCOPPA5.0",
  "reference": "12345 {A UNIQUE ID}",
  "target": {
    "fn": "Barbara",
    "ln": "Miller",
    "addr": "123 Main St",
    "city": "Stratford",
    "state": "CT",
    "zip": "06614",
    "dob": "19740821",
    "ssn": "5698",
    "age": "18+",
    "test_key": "general_identity"
  }
}
```

{% endtab %}
{% endtabs %}

### Body parameters

| Name                                      | Type   | Description                                                                |
| ----------------------------------------- | ------ | -------------------------------------------------------------------------- |
| user<mark style="color:red;">\*</mark>    | string | Your account's API username                                                |
| pass<mark style="color:red;">\*</mark>    | string | Your account's API password                                                |
| service<mark style="color:red;">\*</mark> | string | The service name (`IDMatchCOPPA5.0`)                                       |
| reference                                 | string | A unique identifier for your customer                                      |
| target                                    | object | The individual being sent for verification                                 |
| fn<mark style="color:red;">\*</mark>      | string | The target's first name                                                    |
| ln<mark style="color:red;">\*</mark>      | string | The target's last name                                                     |
| addr<mark style="color:red;">\*</mark>    | string | The target's street address (line 1 and line 2)                            |
| city                                      | string | The target's city                                                          |
| state                                     | string | The target's state                                                         |
| zip<mark style="color:red;">\*</mark>     | string | The target's zip                                                           |
| dob                                       | string | The target's Date of Birth (`YYYYMMDD` format)                             |
| ssn<mark style="color:red;">\*</mark>     | string | The target's SSN (Full 9, Last 4, or IDR Calc). See [IDR Calc](#idr-calc). |
| phone                                     | string | The target's phone number                                                  |
| email                                     | string | The target's email address                                                 |
| age<mark style="color:red;">\*</mark>     | string | The age to check (sent as `"age+"` — e.g. `"18+"`, `"21+"`)                |
| test\_key                                 | string | The test key value that you are using to test                              |

<mark style="color:red;">\*</mark> Required.

### Responses

{% tabs %}
{% tab title="200 PASS" %}

```json
{
  "meta": {
    "company": "Company ABC, Inc.",
    "confirmation": "21201890",
    "reference": "12345 {A UNIQUE ID}",
    "service": "IDMatchCOPPA5.0",
    "timestamp": "2020-08-08 17:56:14",
    "user": "user@company.com"
  },
  "result": {
    "action": "PASS",
    "detail": "ALL CHECKS PASSED",
    "issues": []
  }
}
```

{% endtab %}

{% tab title="200 REVIEW" %}

```json
{
  "meta": {
    "company": "Company ABC, Inc.",
    "confirmation": "21201890",
    "reference": "12345 {A UNIQUE ID}",
    "service": "IDMatchCOPPA5.0",
    "timestamp": "2020-08-08 17:56:14",
    "user": "user@company.com"
  },
  "result": {
    "action": "REVIEW",
    "detail": "TRANSACTION REQUIRES FURTHER ATTENTION",
    "issues": [
      "SSN CHECK FAILED"
    ]
  }
}
```

{% endtab %}

{% tab title="200 FAIL" %}

```json
{
  "meta": {
    "company": "Company ABC, Inc.",
    "confirmation": "21201890",
    "reference": "12345 {A UNIQUE ID}",
    "service": "IDMatchCOPPA5.0",
    "timestamp": "2020-08-08 17:56:14",
    "user": "user@company.com"
  },
  "result": {
    "action": "FAIL",
    "detail": "TARGET IS UNDERAGE",
    "issues": []
  }
}
```

{% endtab %}
{% endtabs %}

{% hint style="info" %}
**PRO TIP:** Send a unique `reference` value with each request so you can reconcile the synchronous response back to the customer record in your own system.
{% endhint %}

***

## IDMatchCOPPA5.0.NO.ADDRESS

A variant of the base service for cases where you cannot collect the target's street address. Instead of locating the target by address, it uses the SSN variable together with **either** a Date of Birth **or** a phone number.

Everything else — the endpoint, response objects, rulesets, and testing process — is identical to the base **IDMatchCOPPA5.0** service. Only the required inputs differ, as described below.

{% hint style="info" %}
**Required inputs for this variant:**

* First name (`fn`)
* Last name (`ln`)
* SSN variable (`ssn` — Full 9, Last 4, or IDR Calc)
* **At least one** of the following:
  * Date of Birth (`dob`)
  * Phone number (`phone`)

You do **not** need to send `addr`, `city`, `state`, or `zip` with this variant.
{% endhint %}

### Request

{% tabs %}
{% tab title="cURL" %}

```bash
curl -X POST https://production.idresponse.com/process/5/gateway \
-H "Content-Type: application/json" \
-d '{
  "user": "USERNAME",
  "pass": "PASSWORD",
  "service": "IDMatchCOPPA5.0.NO.ADDRESS",
  "reference": "12345 {A UNIQUE ID}",
  "target": {
    "fn": "Barbara",
    "ln": "Miller",
    "dob": "19740821",
    "ssn": "5698",
    "age": "18+",
    "test_key": "general_identity"
  }
}'
```

{% endtab %}

{% tab title="JSON" %}

```json
{
  "user": "USERNAME",
  "pass": "PASSWORD",
  "service": "IDMatchCOPPA5.0.NO.ADDRESS",
  "reference": "12345 {A UNIQUE ID}",
  "target": {
    "fn": "Barbara",
    "ln": "Miller",
    "dob": "19740821",
    "ssn": "5698",
    "age": "18+",
    "test_key": "general_identity"
  }
}
```

{% endtab %}
{% endtabs %}

### Body parameters

| Name                                      | Type   | Description                                                                      |
| ----------------------------------------- | ------ | -------------------------------------------------------------------------------- |
| user<mark style="color:red;">\*</mark>    | string | Your account's API username                                                      |
| pass<mark style="color:red;">\*</mark>    | string | Your account's API password                                                      |
| service<mark style="color:red;">\*</mark> | string | The service name (`IDMatchCOPPA5.0.NO.ADDRESS`)                                  |
| reference                                 | string | A unique identifier for your customer                                            |
| target                                    | object | The individual being sent for verification                                       |
| fn<mark style="color:red;">\*</mark>      | string | The target's first name                                                          |
| ln<mark style="color:red;">\*</mark>      | string | The target's last name                                                           |
| ssn<mark style="color:red;">\*</mark>     | string | The target's SSN (Full 9, Last 4, or IDR Calc). See [IDR Calc](#idr-calc).       |
| dob<mark style="color:red;">†</mark>      | string | The target's Date of Birth (`YYYYMMDD` format). Required if `phone` is not sent. |
| phone<mark style="color:red;">†</mark>    | string | The target's phone number. Required if `dob` is not sent.                        |
| email                                     | string | The target's email address                                                       |
| age<mark style="color:red;">\*</mark>     | string | The age to check (sent as `"age+"` — e.g. `"18+"`, `"21+"`)                      |
| test\_key                                 | string | The test key value that you are using to test                                    |

<mark style="color:red;">\*</mark> Required.   <mark style="color:red;">†</mark> You must send **at least one** of `dob` or `phone`.

### Responses

Response objects are identical to the base service. See [Response reference](#response-reference) for all possible `action`, `detail`, and `issues` values.

***

## Response reference

{% hint style="warning" %}
**`REVIEW` does not mean `PASS`.** Only a `PASS` action confirms a verified adult. If a transaction returns anything other than `PASS` — including `REVIEW` or `FAIL` — treat the target as **not verified** and do **not** consider them verified for COPPA VPC (Verifiable Parental Consent) purposes.
{% endhint %}

### Action and detail

The following are all values that will be returned in the `result` object of the response.

| Action | Detail                                 | Description                                                                                                                                              |
| ------ | -------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
| FAIL   | NO MATCH                               | No matching identity found in the data sources                                                                                                           |
| FAIL   | TARGET IS DECEASED                     | Target found as a deceased identity                                                                                                                      |
| FAIL   | MINOR SUBMITTED                        | The DOB submitted for the target is under 18                                                                                                             |
| FAIL   | TARGET IS UNDERAGE                     | The target's DOB was found on file and is under 18                                                                                                       |
| FAIL   | POSSIBLE MINOR                         | Multiple DOBs are on file, at least one is under 18, and we could not determine which one belongs to the target                                          |
| FAIL   | AGE NOT VERIFIED                       | No DOB was on file for this individual, so we could not verify their age                                                                                 |
| REVIEW | TRANSACTION REQUIRES FURTHER ATTENTION | Target found and not deceased, but at least one identity attribute provided does not match. For this service, the only issue will be `SSN CHECK FAILED`. |
| PASS   | ALL CHECKS PASSED                      | Target was found, is not deceased, and has passed all verification checks                                                                                |

### Issues

When a transaction returns `REVIEW`, the response includes a list of issues. This list can contain any of the values below.

| Issue            | Description                                 |
| ---------------- | ------------------------------------------- |
| SSN CHECK FAILED | The SSN provided does not match any on file |

***

## Rules

Both variants process with the same default base ruleset:

{% hint style="success" %}
The base ruleset will return a **PASS** when:

* A match is found
* The target is not deceased
* The target is 18+
* The target has provided an accurate SSN value
  {% endhint %}

{% hint style="warning" %}
The base ruleset will return a **REVIEW** when:

* A match is found
* The target is not deceased
* The target is 18+
* The target did not provide an accurate SSN value
  {% endhint %}

{% hint style="danger" %}
The base ruleset will return a **FAIL** when:

* A match is not found
* The target is deceased
* The target could not be confirmed as 18+
  {% endhint %}

***

## IDR Calc

IDR Calc is Veratad's patented process that lets the user sum at least two digits of their SSN to prove they know it, without collecting sensitive PII. Instead of sending an `ssn` value, send the `dcalc_mask` and `dcalc_answer` attributes.

```json
{
  "user": "USERNAME",
  "pass": "PASSWORD",
  "service": "IDMatchCOPPA5.0",
  "reference": "12345 {A UNIQUE ID}",
  "target": {
    "fn": "Barbara",
    "ln": "Miller",
    "addr": "123 Main St",
    "city": "Stratford",
    "state": "CT",
    "zip": "06614",
    "dob": "19740821",
    "dcalc_mask": "100000001",
    "dcalc_answer": "16",
    "age": "18+",
    "test_key": "general_identity"
  }
}
```

| Attribute     | Description                                                                                                                             |
| ------------- | --------------------------------------------------------------------------------------------------------------------------------------- |
| dcalc\_mask   | Tells the system which digits you asked the customer to sum. Place a `1` in each position you summed and a `0` in every other position. |
| dcalc\_answer | The sum the user entered.                                                                                                               |

***

## Testing

Use the `test_key` attribute to test the service. When `test_key` is provided, the system automatically bypasses the live data sources and queries the testing database instead. These transactions are free of charge — to access live data, do not send this attribute.

{% content-ref url="/pages/-Lrp-fueX5LNIL3YLyzR" %}
[Test Cases](/testing-1/additional-test-cases.md)
{% endcontent-ref %}